@opensip-cli/checks-typescript 0.1.0

package/dist/checks/quality/patterns/stream-buffer-size-limits.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @fileoverview Stream Buffer Size Limits Check
+ *
+ * Detects Buffer.concat() and stream buffering patterns without size limit guards.
+ * These patterns can lead to DoS vulnerabilities when processing untrusted input.
+ */
+/**
+ * Check: quality/stream-buffer-size-limits
+ *
+ * Detects unbounded buffer operations (DoS risk).
+ */
+export declare const streamBufferSizeLimits: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=stream-buffer-size-limits.d.ts.map

package/dist/checks/quality/patterns/stream-buffer-size-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-buffer-size-limits.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/stream-buffer-size-limits.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AA8HH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sCA4DjC,CAAC"}

package/dist/checks/quality/patterns/stream-buffer-size-limits.js

@@ -0,0 +1,163 @@
+// @fitness-ignore-file no-generic-error -- Generic errors appropriate in this context
+/**
+ * @fileoverview Stream Buffer Size Limits Check
+ *
+ * Detects Buffer.concat() and stream buffering patterns without size limit guards.
+ * These patterns can lead to DoS vulnerabilities when processing untrusted input.
+ */
+import { defineCheck, stripStringsAndComments } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/** Patterns that indicate bounded buffer usage */
+const BOUNDED_PATTERNS = [
+    /maxSize/i,
+    /MAX_SIZE/,
+    /maxLength/i,
+    /sizeLimit/i,
+    /maxBuffer/i,
+    /\.length\s*[<>]/,
+    /\.byteLength\s*[<>]/,
+    /totalSize\s*[<>]/,
+    /cipher\.final\(\)/,
+    /decipher\.final\(\)/,
+    // Bounded chunk-loop pattern: `for (let X = 0; X < ARR.length; X += CONSTANT)`.
+    // The classic array-chunking idiom — pushes happen at most
+    // `ceil(ARR.length / CONSTANT)` times, fully bounded by the input array.
+    // `MAX_ROWS_PER_INSERT`, `BATCH_SIZE`, `CHUNK_SIZE` etc. are the typical
+    // names; a literal numeric step also counts. Without this, every
+    // batch-insert helper in the codebase needs an explicit pragma.
+    /for\s*\([^)]{0,200}<\s*[A-Za-z_$][\w$.]{0,80}\.length\s*;[^)]{0,80}\+=\s*(?:[A-Z][A-Z0-9_]{1,80}|\d{1,8})/,
+    // Named chunk-size constants are themselves a strong bounded signal.
+    /\b(?:MAX_ROWS_PER_\w+|BATCH_SIZE|CHUNK_SIZE|PAGE_SIZE|MAX_BATCH|MAX_CHUNK|MAX_PAGE)\b/,
+];
+/** Quick filter keywords */
+const QUICK_FILTER = ['Buffer', 'chunks', 'stream'];
+/**
+ * Get surrounding context for a line (50 lines before and after)
+ */
+function getSurroundingContext(content, line) {
+    const lines = content.split('\n');
+    /* v8 ignore next -- defensive non-negative guard */
+    const start = Math.max(0, line - 50);
+    const end = Math.min(lines.length, line + 50);
+    return lines.slice(start, end).join('\n');
+}
+/**
+ * Check if context has bounded patterns
+ */
+function hasBoundedPattern(context) {
+    return BOUNDED_PATTERNS.some((p) => p.test(context));
+}
+/**
+ * Check Buffer.concat call for size limit guards
+ */
+function checkBufferConcat(ctx) {
+    const { node, sourceFile, content } = ctx;
+    const callText = node.getText(sourceFile);
+    if (!callText.includes('Buffer.concat')) {
+        return null;
+    }
+    const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    const context = getSurroundingContext(content, line);
+    if (hasBoundedPattern(context)) {
+        return null;
+    }
+    const lineNum = line + 1;
+    return {
+        line: lineNum,
+        column: 0,
+        message: 'Buffer.concat() without size limit guard (DoS risk)',
+        severity: 'error',
+        suggestion: 'Add a size limit check before Buffer.concat: track totalSize as chunks are pushed, and throw an error if totalSize exceeds MAX_SIZE (e.g., 10MB)',
+        match: callText.slice(0, 50),
+    };
+}
+/**
+ * Check unbounded push to chunk arrays
+ */
+function checkUnboundedPush(ctx) {
+    const { node, sourceFile, content } = ctx;
+    if (!ts.isPropertyAccessExpression(node.expression)) {
+        return null;
+    }
+    const methodName = node.expression.name.getText(sourceFile);
+    const objectName = node.expression.expression.getText(sourceFile);
+    const isChunkPush = methodName === 'push' && /^(?:chunks?|buffers?|dataChunks?|dataBuffers?)$/.test(objectName);
+    if (!isChunkPush) {
+        return null;
+    }
+    const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    const context = getSurroundingContext(content, line);
+    if (hasBoundedPattern(context)) {
+        return null;
+    }
+    const callText = node.getText(sourceFile);
+    const lineNum = line + 1;
+    return {
+        line: lineNum,
+        column: 0,
+        message: `Unbounded ${objectName}.push() - potential memory exhaustion`,
+        severity: 'warning',
+        suggestion: `Add a size check before pushing: if (totalSize + chunk.length > MAX_SIZE) throw new Error('Size limit exceeded'); then track totalSize += chunk.length`,
+        match: callText.slice(0, 50),
+    };
+}
+/**
+ * Check: quality/stream-buffer-size-limits
+ *
+ * Detects unbounded buffer operations (DoS risk).
+ */
+export const streamBufferSizeLimits = defineCheck({
+    id: 'a3206507-aa7f-4210-ae8c-06ed1025abfd',
+    slug: 'stream-buffer-size-limits',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'high',
+    description: 'Detects Buffer.concat() and stream buffering without size limit guards',
+    longDescription: `**Purpose:** Detects unbounded buffer accumulation patterns that can lead to denial-of-service via memory exhaustion.
+
+**Detects:** Analyzes each file individually using TypeScript AST. Checks for:
+- \`Buffer.concat()\` calls without nearby size-limit guards (\`maxSize\`, \`MAX_SIZE\`, \`sizeLimit\`, \`.length <\`, \`.byteLength <\`)
+- \`.push()\` calls on variables named \`chunk*\` or \`buffer*\` without nearby bounded-pattern guards
+
+**Why it matters:** Unbounded buffering allows an attacker or misbehaving client to exhaust server memory by sending arbitrarily large payloads.
+
+**Scope:** General best practice (security/DoS prevention)`,
+    tags: ['quality', 'security', 'best-practices'],
+    fileTypes: ['ts'],
+    // @fitness-ignore-next-line no-hardcoded-timeouts -- framework default for fitness check execution
+    timeout: 180_000, // 3 minutes - scans buffer usage patterns
+    analyze(content, filePath) {
+        // Quick filter
+        const strippedContent = stripStringsAndComments(content);
+        if (!QUICK_FILTER.some((kw) => strippedContent.includes(kw))) {
+            return [];
+        }
+        const violations = [];
+        const sourceFile = getSharedSourceFile(filePath, content);
+        /* v8 ignore next -- defensive guard */
+        if (!sourceFile)
+            return [];
+        const visit = (node) => {
+            if (ts.isCallExpression(node)) {
+                const callCtx = {
+                    node,
+                    sourceFile,
+                    content,
+                };
+                const bufferConcatViolation = checkBufferConcat(callCtx);
+                if (bufferConcatViolation) {
+                    violations.push(bufferConcatViolation);
+                }
+                const unboundedPushViolation = checkUnboundedPush(callCtx);
+                if (unboundedPushViolation) {
+                    violations.push(unboundedPushViolation);
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+        return violations;
+    },
+});
+//# sourceMappingURL=stream-buffer-size-limits.js.map

package/dist/checks/quality/patterns/stream-buffer-size-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-buffer-size-limits.js","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/stream-buffer-size-limits.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,uBAAuB,EAAuB,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,kDAAkD;AAClD,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,qBAAqB;IACrB,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;IACrB,gFAAgF;IAChF,2DAA2D;IAC3D,yEAAyE;IACzE,yEAAyE;IACzE,iEAAiE;IACjE,gEAAgE;IAChE,2GAA2G;IAC3G,qEAAqE;IACrE,uFAAuF;CACxF,CAAC;AAEF,4BAA4B;AAC5B,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAQpD;;GAEG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,IAAY;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,oDAAoD;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAA0B;IACnD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;IAEzB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,OAAO;QACjB,UAAU,EACR,kJAAkJ;QACpJ,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAA0B;IACpD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAE1C,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,WAAW,GACf,UAAU,KAAK,MAAM,IAAI,iDAAiD,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE9F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;IAEzB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,aAAa,UAAU,uCAAuC;QACvE,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,wJAAwJ;QACpK,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,wEAAwE;IACrF,eAAe,EAAE;;;;;;;;2DAQwC;IACzD,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,gBAAgB,CAAC;IAC/C,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,mGAAmG;IACnG,OAAO,EAAE,OAAO,EAAE,0CAA0C;IAE5D,OAAO,CAAC,OAAO,EAAE,QAAQ;QACvB,eAAe;QACf,MAAM,eAAe,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,uCAAuC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;YACpC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAA0B;oBACrC,IAAI;oBACJ,UAAU;oBACV,OAAO;iBACR,CAAC;gBAEF,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBACzD,IAAI,qBAAqB,EAAE,CAAC;oBAC1B,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACzC,CAAC;gBAED,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,sBAAsB,EAAE,CAAC;oBAC3B,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/quality/patterns/throws-documentation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @fileoverview Missing @throws JSDoc Detection Check
+ *
+ * Detects functions that contain throw statements but lack @throws JSDoc documentation.
+ *
+ */
+/**
+ * Recipe-config shape for throws-documentation. Project-specific typed-error
+ * suffixes (e.g. opensip's `CompositionError`, `CanonicalizationError`)
+ * belong in a recipe's `checks.config['throws-documentation']` block, not
+ * in built-in defaults.
+ */
+export interface ThrowsDocConfig extends Record<string, unknown> {
+    /** Class-name suffixes that mark a thrown error as self-documenting. */
+    additionalSelfDocumentingSuffixes?: readonly string[];
+}
+/**
+ * Check: quality/throws-documentation
+ *
+ * Detects functions with throw statements but no @throws JSDoc.
+ */
+export declare const throwsDocumentation: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=throws-documentation.d.ts.map

package/dist/checks/quality/patterns/throws-documentation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"throws-documentation.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/throws-documentation.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAMH;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9D,wEAAwE;IACxE,iCAAiC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvD;AAmiBD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sCAwC9B,CAAC"}